TFS tfSTRIDE

Built-in scenario

gcp/sample_gcp_serverless_plan.json

GCP Serverless Demo

Analyzed sample_gcp_serverless_plan.json with 11 normalized resources and 4 trust boundaries.

Analyze another plan

Active findings

5

Analysis gaps

0

Trust boundaries

4

Resources

11

Observations

0
High 2
Medium 3
Low 0

Analysis coverage

Audit trail for this run

Terraform resources 11
Unsupported 0
Enabled rules 97
Unresolved refs 0

Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan.

Resource coverage

Provider resources considered
11
Normalized resources
11

No unsupported GCP resource types were encountered.

Rule coverage

Registered rules
97
Disabled rules
0
  • gcp-subnetwork-flow-logs-not-configured1
  • gcp-cloud-run-public-invoker1
  • gcp-cloud-functions-public-invoker1
  • gcp-public-workload-sensitive-data-access2

Analysis gaps

Unassessed operation paths

No operation gaps were reported by the 4 analysis families that ran. This does not establish complete authorization coverage.

Findings

Severity bands

High

2

Internet-exposed GCP workload can access sensitive data services

gcp-public-workload-sensitive-data-access

google_cloud_run_v2_service.api is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.

Category
Information Disclosure
Boundary
workload-to-data-store:google_cloud_run_v2_service.api->google_secret_manager_secret.api_key
Resources
google_cloud_run_v2_service.api, google_secret_manager_secret.api_key, google_secret_manager_secret_iam_member.run_accessor
Evidence
  • public exposure reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers
  • workload identity: serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com
  • cloud run secret access paths: secret_resource=google_secret_manager_secret.api_key; secret_reference=projects/tfstride-demo/secrets/tfstride-api-key; secret_version=5; service_account=tfstride-run@tfstride-demo.iam.gserviceaccount.com; iam_resource=google_secret_manager_secret_iam_member.run_accessor; role=roles/secretmanager.secretAccessor; grant_scope=secret:projects/tfstride-demo/secrets/tfstride-api-key; access_state=granted; condition_state=not_configured
  • resource policy sources: google_secret_manager_secret_iam_member.run_accessor

Internet-exposed GCP workload can access sensitive data services

gcp-public-workload-sensitive-data-access

google_cloudfunctions_function.worker is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.

Category
Information Disclosure
Boundary
workload-to-data-store:google_cloudfunctions_function.worker->google_secret_manager_secret.api_key
Resources
google_cloudfunctions_function.worker, google_secret_manager_secret.api_key, google_secret_manager_secret_iam_member.run_accessor, google_secret_manager_secret_iam_member.function_accessor
Evidence
  • public exposure reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers
  • workload identity: serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com
  • data access path: google_cloudfunctions_function.worker reaches google_secret_manager_secret.api_key
  • boundary rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com.
  • resource policy sources: google_secret_manager_secret_iam_member.run_accessor; google_secret_manager_secret_iam_member.function_accessor

Medium

3

Cloud Functions function is publicly invokable

gcp-cloud-functions-public-invoker

google_cloudfunctions_function.worker allows public HTTP access and grants Cloud Functions invoke permission to public GCP principals. Unauthenticated internet clients can reach the function entry point without an organization-owned identity boundary.

Category
Spoofing
Boundary
internet-to-service:internet->google_cloudfunctions_function.worker
Resources
google_cloudfunctions_function.worker, google_cloudfunctions_function_iam_member.public_invoker
Evidence
  • public invoker bindings: source=google_cloudfunctions_function_iam_member.public_invoker; role=roles/cloudfunctions.invoker; member=allAuthenticatedUsers
  • public access reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers
  • public exposure reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers

Cloud Run service is publicly invokable

gcp-cloud-run-public-invoker

google_cloud_run_v2_service.api allows public ingress and grants Cloud Run invoke permission to public GCP principals. Unauthenticated internet clients can reach the service entry point without an organization-owned identity boundary.

Category
Spoofing
Boundary
internet-to-service:internet->google_cloud_run_v2_service.api
Resources
google_cloud_run_v2_service.api, google_cloud_run_v2_service_iam_member.public_invoker
Evidence
  • public invoker bindings: source=google_cloud_run_v2_service_iam_member.public_invoker; role=roles/run.invoker; member=allUsers
  • public access reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers
  • public exposure reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers

GCP subnetwork Flow Logs are not configured

gcp-subnetwork-flow-logs-not-configured

google_compute_subnetwork.app does not configure VPC Flow Logs in this Terraform plan. Without subnetwork flow telemetry, network investigation, lateral-movement review, and egress analysis can lack packet-flow evidence for workloads attached to this subnet.

Category
Repudiation
Boundary
not-applicable
Resources
google_compute_subnetwork.app
Evidence
  • subnetwork flow log posture: address=google_compute_subnetwork.app; type=google_compute_subnetwork; name=app; identifier=tfstride-app; flow_log_state=not_configured; network=google_compute_network.main.id; project=tfstride-demo

Low

0

No low findings.

Observations

Controls and mitigating signals

No observations were recorded for this plan.

Trust boundaries

Crossings that drive the model

Source
Internet
Relationship
internet-to-service
Destination
google_cloud_run_v2_service.api

Rationale: The resource is directly reachable or intentionally exposed to unauthenticated network clients.

Source
Internet
Relationship
internet-to-service
Destination
google_cloudfunctions_function.worker

Rationale: The resource is directly reachable or intentionally exposed to unauthenticated network clients.

Source
google_cloud_run_v2_service.api
Relationship
workload-to-data-store
Destination
google_secret_manager_secret.api_key

Rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.run_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com.

Source
google_cloudfunctions_function.worker
Relationship
workload-to-data-store
Destination
google_secret_manager_secret.api_key

Rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com.

Raw outputs

Stable contract and markdown

JSON report 
{
  "kind": "tfstride-report",
  "version": "1.3",
  "tool": {
    "name": "tfstride",
    "version": "0.5.0"
  },
  "title": "GCP Serverless Demo",
  "analyzed_file": "sample_gcp_serverless_plan.json",
  "analyzed_path": "sample_gcp_serverless_plan.json",
  "summary": {
    "normalized_resources": 11,
    "unsupported_resources": 0,
    "trust_boundaries": 4,
    "active_findings": 5,
    "total_findings": 5,
    "suppressed_findings": 0,
    "baselined_findings": 0,
    "severity_counts": {
      "high": 2,
      "medium": 3,
      "low": 0
    }
  },
  "filtering": {
    "total_findings": 5,
    "active_findings": 5,
    "suppressed_findings": 0,
    "baselined_findings": 0,
    "suppressions_path": null,
    "baseline_path": null
  },
  "analysis_coverage": {
    "resources": {
      "total_resources": 11,
      "provider_resources": 11,
      "normalized_resources": 11,
      "unsupported_resources": 0,
      "plan_time_unknown_resources": 0,
      "unsupported_resource_types": {}
    },
    "rules": {
      "registered_rule_count": 97,
      "enabled_rules": [
        "gcp-sensitive-resource-iam-external-access",
        "gcp-pubsub-public-access",
        "gcp-pubsub-topic-customer-managed-encryption-missing",
        "gcp-pubsub-message-retention-insufficient",
        "gcp-pubsub-subscription-dead-letter-policy-missing",
        "gcp-bigquery-public-access",
        "gcp-cloud-sql-public-authorized-network",
        "gcp-cloud-sql-backup-disabled",
        "gcp-cloud-sql-public-ip-without-private-network",
        "gcp-cloud-sql-ssl-not-required",
        "gcp-cloud-sql-point-in-time-recovery-disabled",
        "gcp-cloud-sql-deletion-protection-disabled",
        "gcp-cloud-sql-zonal-availability",
        "gcp-cloud-sql-query-insights-disabled",
        "gcp-cloud-sql-connector-enforcement-not-required",
        "gcp-firestore-customer-managed-encryption-missing",
        "gcp-firestore-point-in-time-recovery-disabled-or-unknown",
        "gcp-firestore-delete-protection-disabled-or-unknown",
        "gcp-cloud-sql-private-connectivity-not-modeled",
        "gcp-private-workload-private-google-access-disabled",
        "gcp-gcs-public-access",
        "gcp-gcs-uniform-bucket-level-access-disabled",
        "gcp-gcs-public-access-prevention-not-enforced",
        "gcp-gcs-versioning-disabled",
        "gcp-gcs-customer-managed-encryption-missing",
        "gcp-gcs-retention-policy-insufficient",
        "gcp-artifact-registry-docker-tags-mutable",
        "gcp-artifact-registry-customer-managed-encryption-missing",
        "gcp-artifact-registry-vulnerability-scanning-disabled",
        "gcp-secret-manager-customer-managed-encryption-missing",
        "gcp-secret-manager-lifecycle-posture-incomplete",
        "gcp-kms-key-rotation-not-configured-or-too-long",
        "gcp-kms-key-destroy-scheduled-duration-too-short",
        "gcp-public-compute-broad-ingress",
        "gcp-public-load-balanced-workload",
        "gcp-load-balancer-http-public-proxy",
        "gcp-load-balancer-ssl-policy-missing-or-weak",
        "gcp-public-load-balancer-cloud-armor-missing",
        "gcp-compute-os-login-disabled",
        "gcp-gke-public-control-plane",
        "gcp-gke-broad-authorized-networks",
        "gcp-gke-workload-identity-disabled",
        "gcp-gke-legacy-metadata-endpoints-enabled",
        "gcp-gke-broad-node-service-account",
        "gcp-gke-control-plane-logging-incomplete",
        "gcp-scc-asset-discovery-disabled",
        "gcp-logging-exclusion-drops-audit-security-logs",
        "gcp-logging-sink-audit-export-incomplete",
        "gcp-central-audit-sink-not-modeled",
        "gcp-subnetwork-flow-logs-not-configured",
        "gcp-subnetwork-flow-log-capture-incomplete",
        "gcp-gke-network-policy-disabled",
        "gcp-gke-secrets-encryption-not-configured",
        "gcp-gke-legacy-abac-enabled-or-unknown",
        "gcp-gke-client-certificate-auth-enabled-or-unknown",
        "gcp-gke-shielded-nodes-disabled-or-unknown",
        "gcp-gke-binary-authorization-not-enabled",
        "gcp-cloud-run-public-invoker",
        "gcp-cloud-functions-public-invoker",
        "gcp-cloud-run-image-not-digest-pinned",
        "gcp-cloud-run-artifact-registry-mutable-tag",
        "gcp-cloud-run-can-modify-image-repository",
        "gcp-cloud-run-sensitive-environment-value-inline",
        "gcp-cloud-run-secret-access-blast-radius",
        "gcp-public-cloud-run-firestore-mutation-access",
        "gcp-public-cloud-run-firestore-entity-disruption",
        "gcp-public-cloud-run-firestore-database-topology-disruption",
        "gcp-public-cloud-run-firestore-read-access",
        "gcp-public-cloud-run-kms-decrypt-access",
        "gcp-public-cloud-run-kms-signing-access",
        "gcp-public-cloud-run-kms-key-disruption",
        "gcp-public-cloud-run-kms-authorization-delegation",
        "gcp-public-cloud-run-secret-tampering",
        "gcp-public-cloud-run-secret-disruption",
        "gcp-public-cloud-run-gcs-mutation-access",
        "gcp-public-cloud-run-gcs-object-disruption",
        "gcp-public-cloud-run-gcs-bucket-topology-disruption",
        "gcp-public-cloud-run-pubsub-mutation-access",
        "gcp-public-cloud-run-pubsub-consume-access",
        "gcp-public-cloud-run-pubsub-message-disruption",
        "gcp-public-cloud-run-pubsub-topology-disruption",
        "gcp-public-cloud-run-logging-sink-disruption",
        "gcp-service-account-iam-broad-principal",
        "gcp-service-account-iam-privileged-role",
        "gcp-service-account-key-hygiene",
        "gcp-service-account-key-effective-access",
        "gcp-workload-identity-pool-wide-impersonation",
        "gcp-workload-identity-provider-unconditioned-broad-trust",
        "gcp-workload-identity-privileged-service-account-access",
        "gcp-org-folder-iam-broad-principal",
        "gcp-org-folder-iam-privileged-role",
        "gcp-project-iam-broad-principal",
        "gcp-project-iam-privileged-role",
        "gcp-iam-privileged-assignment",
        "gcp-inherited-iam-sensitive-resource-access",
        "gcp-inherited-iam-blast-radius",
        "gcp-public-workload-sensitive-data-access"
      ],
      "disabled_rules": [],
      "severity_overrides": {},
      "finding_counts_by_rule": {
        "gcp-sensitive-resource-iam-external-access": 0,
        "gcp-pubsub-public-access": 0,
        "gcp-pubsub-topic-customer-managed-encryption-missing": 0,
        "gcp-pubsub-message-retention-insufficient": 0,
        "gcp-pubsub-subscription-dead-letter-policy-missing": 0,
        "gcp-bigquery-public-access": 0,
        "gcp-cloud-sql-public-authorized-network": 0,
        "gcp-cloud-sql-backup-disabled": 0,
        "gcp-cloud-sql-public-ip-without-private-network": 0,
        "gcp-cloud-sql-ssl-not-required": 0,
        "gcp-cloud-sql-point-in-time-recovery-disabled": 0,
        "gcp-cloud-sql-deletion-protection-disabled": 0,
        "gcp-cloud-sql-zonal-availability": 0,
        "gcp-cloud-sql-query-insights-disabled": 0,
        "gcp-cloud-sql-connector-enforcement-not-required": 0,
        "gcp-firestore-customer-managed-encryption-missing": 0,
        "gcp-firestore-point-in-time-recovery-disabled-or-unknown": 0,
        "gcp-firestore-delete-protection-disabled-or-unknown": 0,
        "gcp-cloud-sql-private-connectivity-not-modeled": 0,
        "gcp-private-workload-private-google-access-disabled": 0,
        "gcp-gcs-public-access": 0,
        "gcp-gcs-uniform-bucket-level-access-disabled": 0,
        "gcp-gcs-public-access-prevention-not-enforced": 0,
        "gcp-gcs-versioning-disabled": 0,
        "gcp-gcs-customer-managed-encryption-missing": 0,
        "gcp-gcs-retention-policy-insufficient": 0,
        "gcp-artifact-registry-docker-tags-mutable": 0,
        "gcp-artifact-registry-customer-managed-encryption-missing": 0,
        "gcp-artifact-registry-vulnerability-scanning-disabled": 0,
        "gcp-secret-manager-customer-managed-encryption-missing": 0,
        "gcp-secret-manager-lifecycle-posture-incomplete": 0,
        "gcp-kms-key-rotation-not-configured-or-too-long": 0,
        "gcp-kms-key-destroy-scheduled-duration-too-short": 0,
        "gcp-public-compute-broad-ingress": 0,
        "gcp-public-load-balanced-workload": 0,
        "gcp-load-balancer-http-public-proxy": 0,
        "gcp-load-balancer-ssl-policy-missing-or-weak": 0,
        "gcp-public-load-balancer-cloud-armor-missing": 0,
        "gcp-compute-os-login-disabled": 0,
        "gcp-gke-public-control-plane": 0,
        "gcp-gke-broad-authorized-networks": 0,
        "gcp-gke-workload-identity-disabled": 0,
        "gcp-gke-legacy-metadata-endpoints-enabled": 0,
        "gcp-gke-broad-node-service-account": 0,
        "gcp-gke-control-plane-logging-incomplete": 0,
        "gcp-scc-asset-discovery-disabled": 0,
        "gcp-logging-exclusion-drops-audit-security-logs": 0,
        "gcp-logging-sink-audit-export-incomplete": 0,
        "gcp-central-audit-sink-not-modeled": 0,
        "gcp-subnetwork-flow-logs-not-configured": 1,
        "gcp-subnetwork-flow-log-capture-incomplete": 0,
        "gcp-gke-network-policy-disabled": 0,
        "gcp-gke-secrets-encryption-not-configured": 0,
        "gcp-gke-legacy-abac-enabled-or-unknown": 0,
        "gcp-gke-client-certificate-auth-enabled-or-unknown": 0,
        "gcp-gke-shielded-nodes-disabled-or-unknown": 0,
        "gcp-gke-binary-authorization-not-enabled": 0,
        "gcp-cloud-run-public-invoker": 1,
        "gcp-cloud-functions-public-invoker": 1,
        "gcp-cloud-run-image-not-digest-pinned": 0,
        "gcp-cloud-run-artifact-registry-mutable-tag": 0,
        "gcp-cloud-run-can-modify-image-repository": 0,
        "gcp-cloud-run-sensitive-environment-value-inline": 0,
        "gcp-cloud-run-secret-access-blast-radius": 0,
        "gcp-public-cloud-run-firestore-mutation-access": 0,
        "gcp-public-cloud-run-firestore-entity-disruption": 0,
        "gcp-public-cloud-run-firestore-database-topology-disruption": 0,
        "gcp-public-cloud-run-firestore-read-access": 0,
        "gcp-public-cloud-run-kms-decrypt-access": 0,
        "gcp-public-cloud-run-kms-signing-access": 0,
        "gcp-public-cloud-run-kms-key-disruption": 0,
        "gcp-public-cloud-run-kms-authorization-delegation": 0,
        "gcp-public-cloud-run-secret-tampering": 0,
        "gcp-public-cloud-run-secret-disruption": 0,
        "gcp-public-cloud-run-gcs-mutation-access": 0,
        "gcp-public-cloud-run-gcs-object-disruption": 0,
        "gcp-public-cloud-run-gcs-bucket-topology-disruption": 0,
        "gcp-public-cloud-run-pubsub-mutation-access": 0,
        "gcp-public-cloud-run-pubsub-consume-access": 0,
        "gcp-public-cloud-run-pubsub-message-disruption": 0,
        "gcp-public-cloud-run-pubsub-topology-disruption": 0,
        "gcp-public-cloud-run-logging-sink-disruption": 0,
        "gcp-service-account-iam-broad-principal": 0,
        "gcp-service-account-iam-privileged-role": 0,
        "gcp-service-account-key-hygiene": 0,
        "gcp-service-account-key-effective-access": 0,
        "gcp-workload-identity-pool-wide-impersonation": 0,
        "gcp-workload-identity-provider-unconditioned-broad-trust": 0,
        "gcp-workload-identity-privileged-service-account-access": 0,
        "gcp-org-folder-iam-broad-principal": 0,
        "gcp-org-folder-iam-privileged-role": 0,
        "gcp-project-iam-broad-principal": 0,
        "gcp-project-iam-privileged-role": 0,
        "gcp-iam-privileged-assignment": 0,
        "gcp-inherited-iam-sensitive-resource-access": 0,
        "gcp-inherited-iam-blast-radius": 0,
        "gcp-public-workload-sensitive-data-access": 2
      }
    },
    "references": {
      "unresolved_reference_count": 0,
      "symbolically_resolved_relationships": 0,
      "ambiguous_symbolic_relationships": 0,
      "unresolved_symbolic_relationships": 0,
      "unsupported_symbolic_relationships": 0,
      "unresolved_references": []
    }
  },
  "operation_gaps": {
    "reporting_families": [
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_access"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_bucket_topology"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_mutation"
      },
      {
        "provider": "gcp",
        "name": "cloud_run_gcs_object_deletion"
      }
    ],
    "records": []
  },
  "resource_sensitivity": {
    "basis": "resource_class_assumption",
    "data_contents_state": "not_assessed",
    "explanation": "Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan."
  },
  "inventory": {
    "provider": "gcp",
    "unsupported_resources": [],
    "metadata": {
      "supported_resource_types": [
        "google_artifact_registry_repository",
        "google_artifact_registry_repository_iam_binding",
        "google_artifact_registry_repository_iam_member",
        "google_artifact_registry_repository_iam_policy",
        "google_bigquery_dataset",
        "google_bigquery_dataset_iam_binding",
        "google_bigquery_dataset_iam_member",
        "google_bigquery_dataset_iam_policy",
        "google_bigquery_table",
        "google_bigquery_table_iam_binding",
        "google_bigquery_table_iam_member",
        "google_bigquery_table_iam_policy",
        "google_cloud_run_service",
        "google_cloud_run_service_iam_binding",
        "google_cloud_run_service_iam_member",
        "google_cloud_run_service_iam_policy",
        "google_cloud_run_v2_service",
        "google_cloud_run_v2_service_iam_binding",
        "google_cloud_run_v2_service_iam_member",
        "google_cloud_run_v2_service_iam_policy",
        "google_cloudfunctions2_function",
        "google_cloudfunctions2_function_iam_binding",
        "google_cloudfunctions2_function_iam_member",
        "google_cloudfunctions2_function_iam_policy",
        "google_cloudfunctions_function",
        "google_cloudfunctions_function_iam_binding",
        "google_cloudfunctions_function_iam_member",
        "google_cloudfunctions_function_iam_policy",
        "google_compute_backend_bucket",
        "google_compute_backend_service",
        "google_compute_firewall",
        "google_compute_firewall_policy",
        "google_compute_firewall_policy_association",
        "google_compute_firewall_policy_rule",
        "google_compute_forwarding_rule",
        "google_compute_global_address",
        "google_compute_global_forwarding_rule",
        "google_compute_instance",
        "google_compute_managed_ssl_certificate",
        "google_compute_network",
        "google_compute_network_endpoint_group",
        "google_compute_region_backend_service",
        "google_compute_region_network_endpoint_group",
        "google_compute_region_security_policy",
        "google_compute_region_target_http_proxy",
        "google_compute_region_target_https_proxy",
        "google_compute_region_url_map",
        "google_compute_route",
        "google_compute_router",
        "google_compute_router_nat",
        "google_compute_security_policy",
        "google_compute_service_attachment",
        "google_compute_ssl_policy",
        "google_compute_subnetwork",
        "google_compute_target_http_proxy",
        "google_compute_target_https_proxy",
        "google_compute_url_map",
        "google_container_cluster",
        "google_container_node_pool",
        "google_firestore_database",
        "google_folder",
        "google_folder_iam_binding",
        "google_folder_iam_member",
        "google_folder_iam_policy",
        "google_folder_organization_policy",
        "google_iam_deny_policy",
        "google_iam_workload_identity_pool",
        "google_iam_workload_identity_pool_provider",
        "google_kms_crypto_key",
        "google_kms_crypto_key_iam_binding",
        "google_kms_crypto_key_iam_member",
        "google_kms_crypto_key_iam_policy",
        "google_kms_crypto_key_version",
        "google_kms_key_ring",
        "google_kms_key_ring_iam_binding",
        "google_kms_key_ring_iam_member",
        "google_kms_key_ring_iam_policy",
        "google_logging_organization_exclusion",
        "google_logging_organization_sink",
        "google_logging_project_exclusion",
        "google_logging_project_sink",
        "google_network_connectivity_service_connection_policy",
        "google_org_policy_policy",
        "google_organization_iam_binding",
        "google_organization_iam_custom_role",
        "google_organization_iam_member",
        "google_organization_iam_policy",
        "google_organization_policy",
        "google_project",
        "google_project_iam_binding",
        "google_project_iam_custom_role",
        "google_project_iam_member",
        "google_project_iam_policy",
        "google_project_organization_policy",
        "google_pubsub_subscription",
        "google_pubsub_subscription_iam_binding",
        "google_pubsub_subscription_iam_member",
        "google_pubsub_subscription_iam_policy",
        "google_pubsub_topic",
        "google_pubsub_topic_iam_binding",
        "google_pubsub_topic_iam_member",
        "google_pubsub_topic_iam_policy",
        "google_scc_organization_settings",
        "google_secret_manager_secret",
        "google_secret_manager_secret_iam_binding",
        "google_secret_manager_secret_iam_member",
        "google_secret_manager_secret_iam_policy",
        "google_secret_manager_secret_version",
        "google_service_account",
        "google_service_account_iam_binding",
        "google_service_account_iam_member",
        "google_service_account_iam_policy",
        "google_service_account_key",
        "google_service_networking_connection",
        "google_sql_database_instance",
        "google_storage_bucket",
        "google_storage_bucket_iam_binding",
        "google_storage_bucket_iam_member",
        "google_storage_bucket_iam_policy"
      ],
      "total_input_resources": 11,
      "provider_resource_count": 11,
      "normalized_resource_count": 11,
      "unsupported_resource_types": {}
    },
    "resources": [
      {
        "address": "google_bigquery_dataset.analytics",
        "provider": "gcp",
        "resource_type": "google_bigquery_dataset",
        "name": "analytics",
        "category": "data",
        "identifier": "projects/tfstride-demo/datasets/tfstride_analytics",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "projects/tfstride-demo/datasets/tfstride_analytics",
          "project": "tfstride-demo",
          "bigquery_dataset_id": "tfstride_analytics",
          "bigquery_dataset_reference": "projects/tfstride-demo/datasets/tfstride_analytics",
          "labels": {
            "app": "tfstride"
          },
          "delete_contents_on_destroy": false,
          "default_table_expiration_ms": null,
          "description": null,
          "friendly_name": null,
          "location": "US",
          "max_time_travel_hours": null,
          "storage_billing_model": null,
          "customer_managed_encryption": false,
          "storage_encrypted": true
        }
      },
      {
        "address": "google_bigquery_table.events",
        "provider": "gcp",
        "resource_type": "google_bigquery_table",
        "name": "events",
        "category": "data",
        "identifier": "projects/tfstride-demo/datasets/google_bigquery_dataset.analytics.dataset_id/tables/events",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "projects/tfstride-demo/datasets/google_bigquery_dataset.analytics.dataset_id/tables/events",
          "project": "tfstride-demo",
          "bigquery_dataset_id": "google_bigquery_dataset.analytics.dataset_id",
          "bigquery_dataset_reference": "google_bigquery_dataset.analytics.dataset_id",
          "bigquery_table_id": "events",
          "bigquery_table_reference": "projects/tfstride-demo/datasets/google_bigquery_dataset.analytics.dataset_id/tables/events",
          "labels": {},
          "clustering": [],
          "deletion_protection": true,
          "description": null,
          "friendly_name": null,
          "schema": null,
          "time_partitioning": [],
          "view": [],
          "customer_managed_encryption": false,
          "storage_encrypted": true
        }
      },
      {
        "address": "google_cloud_run_v2_service.api",
        "provider": "gcp",
        "resource_type": "google_cloud_run_v2_service",
        "name": "api",
        "category": "compute",
        "identifier": "tfstride-api",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": true,
        "public_exposure": true,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-api",
          "project": "tfstride-demo",
          "service_account_email": "tfstride-run@tfstride-demo.iam.gserviceaccount.com",
          "service_account_member": "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com",
          "service_accounts": [
            {
              "email": "tfstride-run@tfstride-demo.iam.gserviceaccount.com"
            }
          ],
          "labels": {},
          "vpc_enabled": false,
          "provider_managed_egress": true,
          "cloud_run_service_reference": "tfstride-api",
          "region": "us-central1",
          "serverless_ingress": "INGRESS_TRAFFIC_ALL",
          "uri": "https://tfstride-api.run.app",
          "container_image_references": [],
          "container_image_posture_uncertainties": [],
          "cloud_run_secret_references": [
            {
              "source": "google_cloud_run_v2_service",
              "path": "template[0].containers[0].env[0]",
              "value_path": "template[0].containers[0].env[0].value_source",
              "container_name": "api",
              "setting_name": "DB_PASSWORD",
              "state": "reference",
              "is_resolved": true,
              "normalized_setting_name": "db_password",
              "sensitive_category": "password",
              "reference": "projects/tfstride-demo/secrets/tfstride-api-key",
              "reference_kind": "secret_manager",
              "secret_reference": "projects/tfstride-demo/secrets/tfstride-api-key",
              "secret_name": "projects/tfstride-demo/secrets/tfstride-api-key",
              "secret_version": "5",
              "version": "5",
              "secret_version_state": "configured",
              "version_path": "template[0].containers[0].env[0].value_source[0].secret_key_ref.version",
              "secret_reference_path": "template[0].containers[0].env[0].value_source[0].secret_key_ref.secret",
              "target_resolution": "resolved"
            }
          ],
          "cloud_run_secret_posture_uncertainties": [],
          "public_access_reasons": [
            "google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers"
          ],
          "direct_internet_reachable": true,
          "public_exposure_reasons": [
            "google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers"
          ],
          "iam_bindings": [
            {
              "role": "roles/run.invoker",
              "members": [
                "allUsers"
              ],
              "source": "google_cloud_run_v2_service_iam_member.public_invoker"
            }
          ],
          "gcp_resource_policy_source_addresses": [
            "google_cloud_run_v2_service_iam_member.public_invoker"
          ],
          "cloud_run_logging_sink_audit_telemetry_disruption_paths": [],
          "cloud_run_kms_operation_paths": [],
          "cloud_run_kms_management_paths": [],
          "cloud_run_firestore_access_paths": [],
          "cloud_run_firestore_entity_deletion_paths": [],
          "cloud_run_firestore_database_topology_destruction_paths": [],
          "cloud_run_gcs_access_paths": [],
          "cloud_run_gcs_object_deletion_paths": [],
          "cloud_run_gcs_bucket_topology_destruction_paths": [],
          "cloud_run_gcs_protected_data_convergences": [],
          "cloud_run_pubsub_access_paths": [],
          "cloud_run_pubsub_topology_destruction_paths": [],
          "cloud_run_pubsub_message_removal_paths": [],
          "cloud_run_secret_access_paths": [
            {
              "workload_address": "google_cloud_run_v2_service.api",
              "workload_type": "google_cloud_run_v2_service",
              "secret_reference": "projects/tfstride-demo/secrets/tfstride-api-key",
              "secret_reference_path": "template[0].containers[0].env[0].value_source[0].secret_key_ref.secret",
              "secret_resource_name": "projects/tfstride-demo/secrets/tfstride-api-key",
              "secret_resource_address": "google_secret_manager_secret.api_key",
              "secret_target_resolution": "resolved_in_plan",
              "secret_resolution_basis": "canonical_resource_name",
              "secret_version": "5",
              "secret_version_state": "configured",
              "version_path": "template[0].containers[0].env[0].value_source[0].secret_key_ref.version",
              "container_name": "api",
              "setting_name": "DB_PASSWORD",
              "service_account_email": "tfstride-run@tfstride-demo.iam.gserviceaccount.com",
              "service_account_member": "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com",
              "identity_kind": "cloud_run_service_account",
              "credential_context": "workload_runtime",
              "iam_resource_address": "google_secret_manager_secret_iam_member.run_accessor",
              "iam_resource_type": "google_secret_manager_secret_iam_member",
              "role": "roles/secretmanager.secretAccessor",
              "role_kind": "built_in",
              "custom_role_permissions": [],
              "grant_scope_type": "secret",
              "grant_scope": "projects/tfstride-demo/secrets/tfstride-api-key",
              "grant_basis": "secret_resource_iam",
              "condition": {},
              "condition_state": "not_configured",
              "access_state": "granted"
            }
          ],
          "cloud_run_secret_management_paths": [],
          "cloud_run_secret_management_path_uncertainties": [
            "google_cloud_run_v2_service.api: Secret Manager IAM posture for google_secret_manager_secret.api_key is incomplete: google_secret_manager_secret_iam_member.run_accessor: IAM scope is unresolved for projects/tfstride-demo/secrets/tfstride-api-key"
          ],
          "artifact_registry_write_paths": []
        }
      },
      {
        "address": "google_cloud_run_v2_service_iam_member.public_invoker",
        "provider": "gcp",
        "resource_type": "google_cloud_run_v2_service_iam_member",
        "name": "public_invoker",
        "category": "iam",
        "identifier": "tfstride-api:roles/run.invoker:allUsers",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "cloud_run_service_reference": "tfstride-api",
          "project": "tfstride-demo",
          "region": "us-central1",
          "iam_role": "roles/run.invoker",
          "iam_member": "allUsers",
          "iam_members": [
            "allUsers"
          ],
          "iam_condition": {},
          "iam_bindings": [
            {
              "role": "roles/run.invoker",
              "members": [
                "allUsers"
              ]
            }
          ],
          "privileged_access_grants": []
        }
      },
      {
        "address": "google_cloudfunctions_function.worker",
        "provider": "gcp",
        "resource_type": "google_cloudfunctions_function",
        "name": "worker",
        "category": "compute",
        "identifier": "tfstride-worker",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": true,
        "public_exposure": true,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-worker",
          "project": "tfstride-demo",
          "service_account_email": "tfstride-fn@tfstride-demo.iam.gserviceaccount.com",
          "service_account_member": "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com",
          "service_accounts": [
            {
              "email": "tfstride-fn@tfstride-demo.iam.gserviceaccount.com"
            }
          ],
          "labels": {},
          "vpc_enabled": false,
          "provider_managed_egress": true,
          "cloud_function_reference": "tfstride-worker",
          "region": "us-central1",
          "runtime": "python312",
          "trigger_http": true,
          "https_trigger_url": null,
          "public_access_reasons": [
            "google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers"
          ],
          "direct_internet_reachable": true,
          "public_exposure_reasons": [
            "google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers"
          ],
          "iam_bindings": [
            {
              "role": "roles/cloudfunctions.invoker",
              "members": [
                "allAuthenticatedUsers"
              ],
              "source": "google_cloudfunctions_function_iam_member.public_invoker"
            }
          ],
          "gcp_resource_policy_source_addresses": [
            "google_cloudfunctions_function_iam_member.public_invoker"
          ]
        }
      },
      {
        "address": "google_cloudfunctions_function_iam_member.public_invoker",
        "provider": "gcp",
        "resource_type": "google_cloudfunctions_function_iam_member",
        "name": "public_invoker",
        "category": "iam",
        "identifier": "tfstride-worker:roles/cloudfunctions.invoker:allAuthenticatedUsers",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "cloud_function_reference": "tfstride-worker",
          "project": "tfstride-demo",
          "region": "us-central1",
          "iam_role": "roles/cloudfunctions.invoker",
          "iam_member": "allAuthenticatedUsers",
          "iam_members": [
            "allAuthenticatedUsers"
          ],
          "iam_condition": {},
          "iam_bindings": [
            {
              "role": "roles/cloudfunctions.invoker",
              "members": [
                "allAuthenticatedUsers"
              ]
            }
          ],
          "privileged_access_grants": []
        }
      },
      {
        "address": "google_compute_network.main",
        "provider": "gcp",
        "resource_type": "google_compute_network",
        "name": "main",
        "category": "network",
        "identifier": "tfstride-main",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-main",
          "project": "tfstride-demo",
          "auto_create_subnetworks": false,
          "routing_mode": "REGIONAL",
          "description": null
        }
      },
      {
        "address": "google_compute_subnetwork.app",
        "provider": "gcp",
        "resource_type": "google_compute_subnetwork",
        "name": "app",
        "category": "network",
        "identifier": "tfstride-app",
        "arn": null,
        "vpc_id": "google_compute_network.main.id",
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "name": "tfstride-app",
          "project": "tfstride-demo",
          "region": "us-central1",
          "network": "google_compute_network.main.id",
          "cidr_range": "10.10.1.0/24",
          "private_ip_google_access": true,
          "purpose": null,
          "stack_type": null,
          "secondary_ip_ranges": [],
          "subnetwork_flow_log_state": "not_configured",
          "subnetwork_flow_log_config": {},
          "subnetwork_flow_log_metadata_fields": [],
          "network_telemetry_posture_uncertainties": [],
          "has_public_route": false,
          "is_public_subnet": false,
          "has_nat_gateway_egress": false
        }
      },
      {
        "address": "google_secret_manager_secret.api_key",
        "provider": "gcp",
        "resource_type": "google_secret_manager_secret",
        "name": "api_key",
        "category": "data",
        "identifier": "projects/tfstride-demo/secrets/tfstride-api-key",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "sensitive",
        "metadata": {
          "name": "projects/tfstride-demo/secrets/tfstride-api-key",
          "secret_id": "tfstride-api-key",
          "project": "tfstride-demo",
          "labels": {
            "app": "tfstride"
          },
          "secret_manager_replication_mode": "automatic",
          "secret_manager_kms_key_names": [
            "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager"
          ],
          "secret_manager_replication": {
            "mode": "automatic",
            "kms_key_names": [
              "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager"
            ]
          },
          "secret_manager_posture_uncertainties": [],
          "secret_manager_ttl": "2592000s",
          "secret_manager_version_destroy_ttl": "604800s",
          "annotations": {},
          "topics": [],
          "customer_managed_encryption": true,
          "storage_encrypted": true,
          "iam_bindings": [
            {
              "role": "roles/secretmanager.secretAccessor",
              "members": [
                "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com"
              ],
              "source": "google_secret_manager_secret_iam_member.run_accessor"
            },
            {
              "role": "roles/secretmanager.secretAccessor",
              "members": [
                "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com"
              ],
              "source": "google_secret_manager_secret_iam_member.function_accessor"
            }
          ],
          "gcp_resource_policy_source_addresses": [
            "google_secret_manager_secret_iam_member.run_accessor",
            "google_secret_manager_secret_iam_member.function_accessor"
          ],
          "secret_manager_iam_grants": [],
          "secret_manager_iam_posture_uncertainties": [
            "google_secret_manager_secret_iam_member.run_accessor: IAM scope is unresolved for projects/tfstride-demo/secrets/tfstride-api-key",
            "google_secret_manager_secret_iam_member.function_accessor: IAM scope is unresolved for projects/tfstride-demo/secrets/tfstride-api-key"
          ],
          "kms_encryption_dependencies": [
            {
              "dependent_address": "google_secret_manager_secret.api_key",
              "dependent_resource_type": "google_secret_manager_secret",
              "dependency_source_address": "google_secret_manager_secret.api_key",
              "dependency_source_type": "google_secret_manager_secret",
              "configuration_path": [
                "replication",
                0,
                "auto",
                0,
                "customer_managed_encryption",
                0,
                "kms_key_name"
              ],
              "configured_key_reference": "projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager",
              "reference_provenance": "planned_value",
              "reference_kind": "crypto_key_resource_name",
              "resolution_state": "unresolved",
              "customer_managed_encryption_state": "configured",
              "candidate_targets": [],
              "key_address": null,
              "key_resource_name": null,
              "key_project": null,
              "key_location": null,
              "key_ring": null,
              "key_purpose": null,
              "key_version_address": null,
              "key_version_resource_name": null,
              "version_reference_is_explicit": false,
              "posture_uncertainties": [
                "Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager does not resolve to a modeled CryptoKey"
              ]
            }
          ],
          "kms_encryption_dependency_uncertainties": [
            "google_secret_manager_secret.api_key: Cloud KMS reference projects/tfstride-demo/locations/global/keyRings/tfstride-app/cryptoKeys/tfstride-secret-manager does not resolve to a modeled CryptoKey"
          ]
        }
      },
      {
        "address": "google_secret_manager_secret_iam_member.function_accessor",
        "provider": "gcp",
        "resource_type": "google_secret_manager_secret_iam_member",
        "name": "function_accessor",
        "category": "iam",
        "identifier": "google_secret_manager_secret.api_key.id:roles/secretmanager.secretAccessor:serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "secret_reference": "google_secret_manager_secret.api_key.id",
          "iam_scope_reference_state": "configured",
          "project": "tfstride-demo",
          "iam_role": "roles/secretmanager.secretAccessor",
          "iam_member": "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com",
          "iam_members": [
            "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com"
          ],
          "iam_condition": {},
          "iam_bindings": [
            {
              "role": "roles/secretmanager.secretAccessor",
              "members": [
                "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com"
              ]
            }
          ],
          "privileged_access_grants": []
        }
      },
      {
        "address": "google_secret_manager_secret_iam_member.run_accessor",
        "provider": "gcp",
        "resource_type": "google_secret_manager_secret_iam_member",
        "name": "run_accessor",
        "category": "iam",
        "identifier": "google_secret_manager_secret.api_key.id:roles/secretmanager.secretAccessor:serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com",
        "arn": null,
        "vpc_id": null,
        "subnet_ids": [],
        "security_group_ids": [],
        "attached_role_arns": [],
        "network_rules": [],
        "policy_statements": [],
        "public_access_configured": false,
        "public_exposure": false,
        "data_sensitivity": "standard",
        "metadata": {
          "secret_reference": "google_secret_manager_secret.api_key.id",
          "iam_scope_reference_state": "configured",
          "project": "tfstride-demo",
          "iam_role": "roles/secretmanager.secretAccessor",
          "iam_member": "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com",
          "iam_members": [
            "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com"
          ],
          "iam_condition": {},
          "iam_bindings": [
            {
              "role": "roles/secretmanager.secretAccessor",
              "members": [
                "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com"
              ]
            }
          ],
          "privileged_access_grants": []
        }
      }
    ]
  },
  "trust_boundaries": [
    {
      "identifier": "internet-to-service:internet->google_cloud_run_v2_service.api",
      "boundary_type": "internet-to-service",
      "source": "internet",
      "target": "google_cloud_run_v2_service.api",
      "description": "Traffic can cross from the public internet to google_cloud_run_v2_service.api.",
      "rationale": "The resource is directly reachable or intentionally exposed to unauthenticated network clients."
    },
    {
      "identifier": "internet-to-service:internet->google_cloudfunctions_function.worker",
      "boundary_type": "internet-to-service",
      "source": "internet",
      "target": "google_cloudfunctions_function.worker",
      "description": "Traffic can cross from the public internet to google_cloudfunctions_function.worker.",
      "rationale": "The resource is directly reachable or intentionally exposed to unauthenticated network clients."
    },
    {
      "identifier": "workload-to-data-store:google_cloud_run_v2_service.api->google_secret_manager_secret.api_key",
      "boundary_type": "workload-to-data-store",
      "source": "google_cloud_run_v2_service.api",
      "target": "google_secret_manager_secret.api_key",
      "description": "google_cloud_run_v2_service.api can interact with google_secret_manager_secret.api_key.",
      "rationale": "GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.run_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com."
    },
    {
      "identifier": "workload-to-data-store:google_cloudfunctions_function.worker->google_secret_manager_secret.api_key",
      "boundary_type": "workload-to-data-store",
      "source": "google_cloudfunctions_function.worker",
      "target": "google_secret_manager_secret.api_key",
      "description": "google_cloudfunctions_function.worker can interact with google_secret_manager_secret.api_key.",
      "rationale": "GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com."
    }
  ],
  "findings": [
    {
      "fingerprint": "sha256:f04001c2e8493937559935380c234dbbba2f0569bd188b4b7037ec8597d14fa5",
      "title": "Internet-exposed GCP workload can access sensitive data services",
      "rule_id": "gcp-public-workload-sensitive-data-access",
      "category": "Information Disclosure",
      "severity": "high",
      "affected_resources": [
        "google_cloud_run_v2_service.api",
        "google_secret_manager_secret.api_key",
        "google_secret_manager_secret_iam_member.run_accessor"
      ],
      "trust_boundary_id": "workload-to-data-store:google_cloud_run_v2_service.api->google_secret_manager_secret.api_key",
      "rationale": "google_cloud_run_v2_service.api is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.",
      "recommended_mitigation": "Run public GCP workloads with narrowly scoped service accounts, remove direct Secret Manager, Cloud KMS, GCS, or Cloud SQL grants from internet-facing instances, and broker sensitive data access through private services where possible.",
      "evidence": [
        {
          "key": "public_exposure_reasons",
          "values": [
            "google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers"
          ]
        },
        {
          "key": "workload_identity",
          "values": [
            "serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com"
          ]
        },
        {
          "key": "cloud_run_secret_access_paths",
          "values": [
            "secret_resource=google_secret_manager_secret.api_key; secret_reference=projects/tfstride-demo/secrets/tfstride-api-key; secret_version=5; service_account=tfstride-run@tfstride-demo.iam.gserviceaccount.com; iam_resource=google_secret_manager_secret_iam_member.run_accessor; role=roles/secretmanager.secretAccessor; grant_scope=secret:projects/tfstride-demo/secrets/tfstride-api-key; access_state=granted; condition_state=not_configured"
          ]
        },
        {
          "key": "resource_policy_sources",
          "values": [
            "google_secret_manager_secret_iam_member.run_accessor"
          ]
        }
      ],
      "severity_reasoning": {
        "internet_exposure": 2,
        "privilege_breadth": 1,
        "data_sensitivity": 2,
        "lateral_movement": 1,
        "blast_radius": 1,
        "final_score": 7,
        "severity": "high",
        "computed_severity": null
      }
    },
    {
      "fingerprint": "sha256:6a8fba2f6eb1f9409d6f281891d9c1a34d53cbf01e3f05ad0fcc88af1150aa35",
      "title": "Internet-exposed GCP workload can access sensitive data services",
      "rule_id": "gcp-public-workload-sensitive-data-access",
      "category": "Information Disclosure",
      "severity": "high",
      "affected_resources": [
        "google_cloudfunctions_function.worker",
        "google_secret_manager_secret.api_key",
        "google_secret_manager_secret_iam_member.run_accessor",
        "google_secret_manager_secret_iam_member.function_accessor"
      ],
      "trust_boundary_id": "workload-to-data-store:google_cloudfunctions_function.worker->google_secret_manager_secret.api_key",
      "rationale": "google_cloudfunctions_function.worker is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.",
      "recommended_mitigation": "Run public GCP workloads with narrowly scoped service accounts, remove direct Secret Manager, Cloud KMS, GCS, or Cloud SQL grants from internet-facing instances, and broker sensitive data access through private services where possible.",
      "evidence": [
        {
          "key": "public_exposure_reasons",
          "values": [
            "google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers"
          ]
        },
        {
          "key": "workload_identity",
          "values": [
            "serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com"
          ]
        },
        {
          "key": "data_access_path",
          "values": [
            "google_cloudfunctions_function.worker reaches google_secret_manager_secret.api_key"
          ]
        },
        {
          "key": "boundary_rationale",
          "values": [
            "GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com."
          ]
        },
        {
          "key": "resource_policy_sources",
          "values": [
            "google_secret_manager_secret_iam_member.run_accessor",
            "google_secret_manager_secret_iam_member.function_accessor"
          ]
        }
      ],
      "severity_reasoning": {
        "internet_exposure": 2,
        "privilege_breadth": 1,
        "data_sensitivity": 2,
        "lateral_movement": 1,
        "blast_radius": 1,
        "final_score": 7,
        "severity": "high",
        "computed_severity": null
      }
    },
    {
      "fingerprint": "sha256:26d830ba0ec2a53756c3eaced1c3be81057169315b2b42d8c7419e083cfc77d6",
      "title": "Cloud Functions function is publicly invokable",
      "rule_id": "gcp-cloud-functions-public-invoker",
      "category": "Spoofing",
      "severity": "medium",
      "affected_resources": [
        "google_cloudfunctions_function.worker",
        "google_cloudfunctions_function_iam_member.public_invoker"
      ],
      "trust_boundary_id": "internet-to-service:internet->google_cloudfunctions_function.worker",
      "rationale": "google_cloudfunctions_function.worker allows public HTTP access and grants Cloud Functions invoke permission to public GCP principals. Unauthenticated internet clients can reach the function entry point without an organization-owned identity boundary.",
      "recommended_mitigation": "Remove `allUsers` and `allAuthenticatedUsers` from Cloud Functions invoker bindings unless anonymous access is intentional, and require authentication, IAP, API Gateway, or a controlled edge policy for public HTTP functions.",
      "evidence": [
        {
          "key": "public_invoker_bindings",
          "values": [
            "source=google_cloudfunctions_function_iam_member.public_invoker; role=roles/cloudfunctions.invoker; member=allAuthenticatedUsers"
          ]
        },
        {
          "key": "public_access_reasons",
          "values": [
            "google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers"
          ]
        },
        {
          "key": "public_exposure_reasons",
          "values": [
            "google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers"
          ]
        }
      ],
      "severity_reasoning": {
        "internet_exposure": 2,
        "privilege_breadth": 0,
        "data_sensitivity": 0,
        "lateral_movement": 0,
        "blast_radius": 1,
        "final_score": 3,
        "severity": "medium",
        "computed_severity": null
      }
    },
    {
      "fingerprint": "sha256:fdfa137966c89eb875eb160f45285149877d78495eec49c0a7250ae0a64e7a28",
      "title": "Cloud Run service is publicly invokable",
      "rule_id": "gcp-cloud-run-public-invoker",
      "category": "Spoofing",
      "severity": "medium",
      "affected_resources": [
        "google_cloud_run_v2_service.api",
        "google_cloud_run_v2_service_iam_member.public_invoker"
      ],
      "trust_boundary_id": "internet-to-service:internet->google_cloud_run_v2_service.api",
      "rationale": "google_cloud_run_v2_service.api allows public ingress and grants Cloud Run invoke permission to public GCP principals. Unauthenticated internet clients can reach the service entry point without an organization-owned identity boundary.",
      "recommended_mitigation": "Remove `allUsers` and `allAuthenticatedUsers` from Cloud Run invoker bindings unless anonymous access is intentional, and front public services with authentication, IAP, API Gateway, or a controlled edge policy.",
      "evidence": [
        {
          "key": "public_invoker_bindings",
          "values": [
            "source=google_cloud_run_v2_service_iam_member.public_invoker; role=roles/run.invoker; member=allUsers"
          ]
        },
        {
          "key": "public_access_reasons",
          "values": [
            "google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers"
          ]
        },
        {
          "key": "public_exposure_reasons",
          "values": [
            "google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers"
          ]
        }
      ],
      "severity_reasoning": {
        "internet_exposure": 2,
        "privilege_breadth": 0,
        "data_sensitivity": 0,
        "lateral_movement": 0,
        "blast_radius": 1,
        "final_score": 3,
        "severity": "medium",
        "computed_severity": null
      }
    },
    {
      "fingerprint": "sha256:d7380b4b3e19c2f29c68019a1757075b9455a4465c9cf613a0fd4a3a2d8dc9e9",
      "title": "GCP subnetwork Flow Logs are not configured",
      "rule_id": "gcp-subnetwork-flow-logs-not-configured",
      "category": "Repudiation",
      "severity": "medium",
      "affected_resources": [
        "google_compute_subnetwork.app"
      ],
      "trust_boundary_id": null,
      "rationale": "google_compute_subnetwork.app does not configure VPC Flow Logs in this Terraform plan. Without subnetwork flow telemetry, network investigation, lateral-movement review, and egress analysis can lack packet-flow evidence for workloads attached to this subnet.",
      "recommended_mitigation": "Enable VPC Flow Logs on subnetworks that host workloads, keep the flow log configuration in Terraform, and export or retain those logs according to investigation and monitoring requirements.",
      "evidence": [
        {
          "key": "subnetwork_flow_log_posture",
          "values": [
            "address=google_compute_subnetwork.app",
            "type=google_compute_subnetwork",
            "name=app",
            "identifier=tfstride-app",
            "flow_log_state=not_configured",
            "network=google_compute_network.main.id",
            "project=tfstride-demo"
          ]
        }
      ],
      "severity_reasoning": {
        "internet_exposure": 0,
        "privilege_breadth": 0,
        "data_sensitivity": 0,
        "lateral_movement": 2,
        "blast_radius": 1,
        "final_score": 3,
        "severity": "medium",
        "computed_severity": null
      }
    }
  ],
  "suppressed_findings": [],
  "baselined_findings": [],
  "observations": [],
  "limitations": [
    "GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.",
    "The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity."
  ]
}
Markdown report 
# GCP Serverless Demo

- Analyzed file: `sample_gcp_serverless_plan.json`
- Provider: `gcp`
- Normalized resources: `11`
- Unsupported resources: `0`

## Summary

This run identified **4 trust boundaries** and **5 findings** across **11 normalized resources**.

- High severity findings: `2`
- Medium severity findings: `3`
- Low severity findings: `0`

## Analysis Coverage

- Terraform resources seen: `11`
- Provider resources considered: `11`
- Normalized resources: `11`
- Unsupported resources: `0`
- Resources with plan-time unknown values: `0`
- Registered provider rules (GCP): `97`
- Enabled provider rules (GCP): `97`
- Disabled rules: `0`
- Severity overrides: `0`
- Configuration-reference resolution: `0 symbolic`, `0 ambiguous`, `0 unresolved`, `0 unsupported`
- Recorded unresolved modeled references: `0`
- Findings by rule:
  - `gcp-subnetwork-flow-logs-not-configured`: `1`
  - `gcp-cloud-run-public-invoker`: `1`
  - `gcp-cloud-functions-public-invoker`: `1`
  - `gcp-public-workload-sensitive-data-access`: `2`

Sensitive resource labels are assumptions based on resource class. tfSTRIDE does not assess stored data contents from the plan.

## Discovered Trust Boundaries

### `internet-to-service`

- Source: `internet`
- Target: `google_cloud_run_v2_service.api`
- Description: Traffic can cross from the public internet to google_cloud_run_v2_service.api.
- Rationale: The resource is directly reachable or intentionally exposed to unauthenticated network clients.

### `internet-to-service`

- Source: `internet`
- Target: `google_cloudfunctions_function.worker`
- Description: Traffic can cross from the public internet to google_cloudfunctions_function.worker.
- Rationale: The resource is directly reachable or intentionally exposed to unauthenticated network clients.

### `workload-to-data-store`

- Source: `google_cloud_run_v2_service.api`
- Target: `google_secret_manager_secret.api_key`
- Description: google_cloud_run_v2_service.api can interact with google_secret_manager_secret.api_key.
- Rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.run_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com.

### `workload-to-data-store`

- Source: `google_cloudfunctions_function.worker`
- Target: `google_secret_manager_secret.api_key`
- Description: google_cloudfunctions_function.worker can interact with google_secret_manager_secret.api_key.
- Rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com.

## Findings

### High

#### Internet-exposed GCP workload can access sensitive data services

- STRIDE category: Information Disclosure
- Affected resources: `google_cloud_run_v2_service.api`, `google_secret_manager_secret.api_key`, `google_secret_manager_secret_iam_member.run_accessor`
- Trust boundary: `workload-to-data-store:google_cloud_run_v2_service.api->google_secret_manager_secret.api_key`
- Severity reasoning: internet_exposure +2, privilege_breadth +1, data_sensitivity +2, lateral_movement +1, blast_radius +1, final_score 7 => high
- Rationale: google_cloud_run_v2_service.api is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.
- Recommended mitigation: Run public GCP workloads with narrowly scoped service accounts, remove direct Secret Manager, Cloud KMS, GCS, or Cloud SQL grants from internet-facing instances, and broker sensitive data access through private services where possible.
- Evidence:
  - public exposure reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers
  - workload identity: serviceAccount:tfstride-run@tfstride-demo.iam.gserviceaccount.com
  - cloud run secret access paths: secret_resource=google_secret_manager_secret.api_key; secret_reference=projects/tfstride-demo/secrets/tfstride-api-key; secret_version=5; service_account=tfstride-run@tfstride-demo.iam.gserviceaccount.com; iam_resource=google_secret_manager_secret_iam_member.run_accessor; role=roles/secretmanager.secretAccessor; grant_scope=secret:projects/tfstride-demo/secrets/tfstride-api-key; access_state=granted; condition_state=not_configured
  - resource policy sources: google_secret_manager_secret_iam_member.run_accessor

#### Internet-exposed GCP workload can access sensitive data services

- STRIDE category: Information Disclosure
- Affected resources: `google_cloudfunctions_function.worker`, `google_secret_manager_secret.api_key`, `google_secret_manager_secret_iam_member.run_accessor`, `google_secret_manager_secret_iam_member.function_accessor`
- Trust boundary: `workload-to-data-store:google_cloudfunctions_function.worker->google_secret_manager_secret.api_key`
- Severity reasoning: internet_exposure +2, privilege_breadth +1, data_sensitivity +2, lateral_movement +1, blast_radius +1, final_score 7 => high
- Rationale: google_cloudfunctions_function.worker is internet-exposed and runs with GCP workload identity serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com. That identity can access google_secret_manager_secret.api_key. A compromise of the public workload can therefore become direct access to sensitive GCP data services.
- Recommended mitigation: Run public GCP workloads with narrowly scoped service accounts, remove direct Secret Manager, Cloud KMS, GCS, or Cloud SQL grants from internet-facing instances, and broker sensitive data access through private services where possible.
- Evidence:
  - public exposure reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers
  - workload identity: serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com
  - data access path: google_cloudfunctions_function.worker reaches google_secret_manager_secret.api_key
  - boundary rationale: GCP workloads cross into a higher-sensitivity data plane when their attached service account is granted data access through IAM: google_secret_manager_secret_iam_member.function_accessor grants roles/secretmanager.secretAccessor to serviceAccount:tfstride-fn@tfstride-demo.iam.gserviceaccount.com.
  - resource policy sources: google_secret_manager_secret_iam_member.run_accessor; google_secret_manager_secret_iam_member.function_accessor

### Medium

#### Cloud Functions function is publicly invokable

- STRIDE category: Spoofing
- Affected resources: `google_cloudfunctions_function.worker`, `google_cloudfunctions_function_iam_member.public_invoker`
- Trust boundary: `internet-to-service:internet->google_cloudfunctions_function.worker`
- Severity reasoning: internet_exposure +2, privilege_breadth +0, data_sensitivity +0, lateral_movement +0, blast_radius +1, final_score 3 => medium
- Rationale: google_cloudfunctions_function.worker allows public HTTP access and grants Cloud Functions invoke permission to public GCP principals. Unauthenticated internet clients can reach the function entry point without an organization-owned identity boundary.
- Recommended mitigation: Remove `allUsers` and `allAuthenticatedUsers` from Cloud Functions invoker bindings unless anonymous access is intentional, and require authentication, IAP, API Gateway, or a controlled edge policy for public HTTP functions.
- Evidence:
  - public invoker bindings: source=google_cloudfunctions_function_iam_member.public_invoker; role=roles/cloudfunctions.invoker; member=allAuthenticatedUsers
  - public access reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers
  - public exposure reasons: google_cloudfunctions_function_iam_member.public_invoker grants roles/cloudfunctions.invoker to allAuthenticatedUsers

#### Cloud Run service is publicly invokable

- STRIDE category: Spoofing
- Affected resources: `google_cloud_run_v2_service.api`, `google_cloud_run_v2_service_iam_member.public_invoker`
- Trust boundary: `internet-to-service:internet->google_cloud_run_v2_service.api`
- Severity reasoning: internet_exposure +2, privilege_breadth +0, data_sensitivity +0, lateral_movement +0, blast_radius +1, final_score 3 => medium
- Rationale: google_cloud_run_v2_service.api allows public ingress and grants Cloud Run invoke permission to public GCP principals. Unauthenticated internet clients can reach the service entry point without an organization-owned identity boundary.
- Recommended mitigation: Remove `allUsers` and `allAuthenticatedUsers` from Cloud Run invoker bindings unless anonymous access is intentional, and front public services with authentication, IAP, API Gateway, or a controlled edge policy.
- Evidence:
  - public invoker bindings: source=google_cloud_run_v2_service_iam_member.public_invoker; role=roles/run.invoker; member=allUsers
  - public access reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers
  - public exposure reasons: google_cloud_run_v2_service_iam_member.public_invoker grants roles/run.invoker to allUsers

#### GCP subnetwork Flow Logs are not configured

- STRIDE category: Repudiation
- Affected resources: `google_compute_subnetwork.app`
- Trust boundary: `not-applicable`
- Severity reasoning: internet_exposure +0, privilege_breadth +0, data_sensitivity +0, lateral_movement +2, blast_radius +1, final_score 3 => medium
- Rationale: google_compute_subnetwork.app does not configure VPC Flow Logs in this Terraform plan. Without subnetwork flow telemetry, network investigation, lateral-movement review, and egress analysis can lack packet-flow evidence for workloads attached to this subnet.
- Recommended mitigation: Enable VPC Flow Logs on subnetworks that host workloads, keep the flow log configuration in Terraform, and export or retain those logs according to investigation and monitoring requirements.
- Evidence:
  - subnetwork flow log posture: address=google_compute_subnetwork.app; type=google_compute_subnetwork; name=app; identifier=tfstride-app; flow_log_state=not_configured; network=google_compute_network.main.id; project=tfstride-demo

### Low

No findings in this severity band.

## Limitations / Unsupported Resources

- GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.
- The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity.

Limits

Unsupported or intentionally scoped areas

  • GCP support covers a curated set of compute, serverless, data, IAM, Kubernetes, networking, audit, private-connectivity, messaging, registry, and key-management resources. Analysis is plan-local and does not model every provider resource, runtime drift, or every organization-level control; provider-specific positive observations remain more limited than finding coverage.
  • The engine reasons over Terraform planned values only and does not validate runtime drift, runtime audit evidence, or post-deployment control-plane activity.